NOISSUE - Add FetchKbsToken RPC support, update protobuf generation, and include additional binaries in CI workflow. (#610)

* feat: add FetchKbsToken RPC support, update protobuf generation, and include additional binaries in CI workflow.

Signed-off-by: Sammy Oina <sammyoina@gmail.com>

* chore: update protoc version and add GetKbsToken mock method with updated kbsHTTPGet signature

Signed-off-by: Sammy Oina <sammyoina@gmail.com>

* test: inject mock attestation client into agentService for resource and KBS tests

Signed-off-by: Sammy Oina <sammyoina@gmail.com>

* test: update key derivation in tests to use Concat KDF instead of HKDF

Signed-off-by: Sammy Oina <sammyoina@gmail.com>

---------

Signed-off-by: Sammy Oina <sammyoina@gmail.com>

pkg/attestation/attestation.go

@@ -42,6 +42,7 @@ type Provider interface {
 	TeeAttestation(teeNonce []byte) ([]byte, error)
 	VTpmAttestation(vTpmNonce []byte) ([]byte, error)
 	AzureAttestationToken(tokenNonce []byte) ([]byte, error)
+	KbsToken() ([]byte, error)
 }
 
 type Verifier interface {

pkg/attestation/azure/snp.go

@@ -134,6 +134,10 @@ func (a provider) AzureAttestationToken(tokenNonce []byte) ([]byte, error) {
 	return []byte(token), nil
 }
 
+func (a provider) KbsToken() ([]byte, error) {
+	return nil, fmt.Errorf("KbsToken not supported on Azure provider")
+}
+
 type verifier struct {
 	writer io.Writer
 }

pkg/attestation/ccaa/provider.go

@@ -129,3 +129,21 @@ func (p *Provider) AzureAttestationToken(nonce []byte) ([]byte, error) {
 
 	return resp.Token, nil
 }
+
+// KbsToken retrieves the official KBS-signed token from the attestation agent.
+func (p *Provider) KbsToken() ([]byte, error) {
+	fmt.Println("[CCAA-PROVIDER] KbsToken called, querying attestation-agent...")
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	resp, err := p.client.GetToken(ctx, &attestation_agent.GetTokenRequest{
+		TokenType: "kbs",
+	})
+	if err != nil {
+		fmt.Printf("[CCAA-PROVIDER] GetToken failed: %v\n", err)
+		return nil, fmt.Errorf("CC attestation-agent GetToken failed for kbs: %w", err)
+	}
+
+	fmt.Printf("[CCAA-PROVIDER] GetToken succeeded! Return raw JSON message, len: %d\n", len(resp.Token))
+	return resp.Token, nil
+}

pkg/attestation/emptyprovider.go

@@ -31,3 +31,7 @@ func (e *EmptyProvider) VTpmAttestation(vTpmNonce []byte) ([]byte, error) {
 func (e *EmptyProvider) AzureAttestationToken(nonce []byte) ([]byte, error) {
 	return nil, nil
 }
+
+func (e *EmptyProvider) KbsToken() ([]byte, error) {
+	return nil, fmt.Errorf("KbsToken not supported on EmptyProvider")
+}

pkg/attestation/tdx/tdx.go

@@ -72,6 +72,10 @@ func (v provider) AzureAttestationToken(tokenNonce []byte) ([]byte, error) {
 	return nil, errors.New("Azure attestation token is not supported")
 }
 
+func (v provider) KbsToken() ([]byte, error) {
+	return nil, errors.New("KbsToken is not supported on TDX provider")
+}
+
 type verifier struct {
 	Policy *checkconfig.Config
 }

pkg/attestation/vtpm/vtpm.go

@@ -120,6 +120,10 @@ func (v provider) AzureAttestationToken(tokenNonce []byte) ([]byte, error) {
 	return nil, errors.New("Azure attestation token is not supported")
 }
 
+func (v provider) KbsToken() ([]byte, error) {
+	return nil, errors.New("KbsToken is not supported on vTPM provider")
+}
+
 type verifier struct {
 	writer io.Writer
 }